CVE-2025-0604
Description
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
Statement
Moderate impact affects Red Hat Build of Keycloak (RHBK) and Red Hat Single Sign-On (RH-SSO) in the keycloak-ldap-federation component. A network attacker with low privileges can exploit the password-reset flow: when an Active Directory user resets a password, Keycloak updates it without performing an LDAP bind to validate the new credentials against AD. An expired or disabled AD account can therefore regain access to Keycloak, resulting in authentication bypass with low confidentiality and integrity impact and no availability impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). For RHBK, the issue is delegated and a fix is being pursued. RH-SSO is affected but is marked WONTFIX, so the current record indicates that no fix is planned for that product.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | 5.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Read Application Data; Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
Acknowledgements
Red Hat would like to thank Dwayne Du for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
